Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of abnormally large Windows shortcut (.lnk) files. This is a known TTP of APT36 (Transparent Tribe), who embed PDF content within LNK files to inflate their size and masquerade as legitimate documents to deceive users. The rule specifically looks for .lnk files with a size greater than 1MB.
PHALT BLYX Startup URL Persistence
Cortex XDR
Detects the creation of .url files in the Windows Startup folder, which can be used for persistence. Specifically identifies a known IOC for PHALT BLYX malware ('DeleteApp.url') and flags other suspicious .url file creations in the Startup folder. This rule filters out common browser processes that might legitimately create .url files.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
Detects the creation of DLL files named with a GUID pattern in common staging directories. This technique was observed being used by the threat actor UKC-1230 to drop surrogate COM DLLs for persistence.
Detects malicious browser extensions associated with the DarkSpectre 'Zoom Stealer' campaign by identifying known malicious extension IDs. The campaign uses these extensions for corporate espionage by stealing meeting intelligence from various video conferencing platforms.
This rule detects the creation of files with specific malicious extension IDs on devices. These extensions are typically associated with browser-based malware or unwanted programs that modify browser behavior, steal data, or perform other malicious activities. The rule specifically looks for `FileCreated` events where the `FileName` matches any of the predefined malicious extension IDs.
Detects suspicious file creations in temporary or user application data directories immediately following browser process activities, indicating potential injected content saved to disk. Aligns with MITRE DET0349 guidance.
This rule detects suspicious Launch Daemons on macOS by looking for files created or modified in the `/Library/LaunchDaemons/` directory. It filters out known legitimate binaries and then flags any remaining files that have low global prevalence (less than 2500 instances) and were first seen more than 90 days ago. Additionally, it checks if the certificate is invalid or not signed by Microsoft, indicating potential malicious activity. This rule is intended for hunting and not for direct alerting due to the need for whitelisting.
This detection monitors for the creation or deletion of files within the TokenBroker and AAD Broker Plugin cache folders. These folders store authentication tokens that, if accessed or manipulated by an unauthorized process, could indicate credential theft activity.
Detects the creation of systemd services used by the PCPcat malware for persistence on Linux systems.
Detects when the WinRAR process creates an executable or shortcut file in a user's Startup folder. This technique is used by adversaries, such as Paper Werewolf, to establish persistence.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
Detects the mass creation of the 'RECOVER-YOUR-FILE.TXT' ransom note, a behavior characteristic of the 01flip ransomware. A high count of these notes on a single host is a strong indicator of compromise, suggesting that data has been encrypted for impact.
Detects the ransom note file 'How To Restore Your Files.txt' created by the RansomHouse 'Mario' encryptor.
Detects the creation of suspicious files (e.g., web shells, executables) by a Node.js or Next.js server process. This activity is a common post-exploitation step after a successful RCE, such as from exploiting CVE-2025-55182 (React2Shell), where an attacker drops a backdoor for persistence.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
This rule detects the creation or modification of executable files with a single-character filename followed by '.exe' (e.g., 'a.exe', 'b.exe'). This pattern is often used by adversaries to evade detection or to make malicious files less conspicuous. The rule specifically excludes 'R for Windows front-end' to reduce false positives related to legitimate software.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
Detects the creation of malicious DLL files used for side-loading by the Ashen Lepus group's AshTag malware suite. These DLLs are often dropped in non-standard locations to be loaded by legitimate executables.
Page 190 of 217